CTI · corroborated · 2026-08-18

JWR Phishing-as-a-Service Kit Uses WebSockets and AES to Run Real-Time Banking Fraud

Full story & timeline

Actors

—

Malware / tools

JWR PhaaS framework

Campaigns

JWR banking fraud campaign

CVEs

—

Victim sectors

bankingfinancial servicespayments

Geography

SingaporeUAESoutheast AsiaMiddle East

MITRE ATT&CK

T1566 Phishing Initial Access
T1557 Adversary-in-the-Middle Credential Access
T1056 Input Capture Collection
T1071 Application Layer Protocol Command and Control

Indicators

No curated indicators tied to this case.

Detections

No detection content yet — case analysis did not yield signal-specific telemetry. Check back after the next daily CTI pass.

References

Source on GitHub